Somebody senior has seen a demo. A business user types “which branches had the worst collection efficiency last quarter” and a chart appears. Now they want it in your bank, your ministry or your hospital. The demo used a public model API. Your network does not allow that. Your regulator would not accept it, and your security team stopped reading at the word “OpenAI”.The blocker is narrower than it looks. AI analytics is not impossible in a closed network; one specific payload, the prompt, has to stay inside. This post describes how we design for that. Apache Superset does what it already does well, with a text-to-SQL service in front of it. In addition, a model server you run yourself exposes the same API shape the public providers use.
Why the prompt is the blocker ??
A text-to-SQL request is not just the user’s question. To write SQL that runs, the model needs to know what exists. For example, the model needs table and column names, types, and which columns are measures or dimensions.
It often also needs metric definitions and the conversation so far. For a regulated organisation every part of that is sensitive:
- The question. “Show NPA movement for accounts linked to customer group X” names a customer group. Questions leak intent, investigations and names.
- The schema. Column names such as aadhaar_hash or diagnosis_code describe what you hold and how you process it. Outsourcing and data-protection reviews treat that as information about personal data processing, not harmless metadata.
- Sample values. If the AI layer sends distinct values so the model can match “Bhubaneswar” to a branch code, it is sending data.
- Results. Some designs send query results back to the model to write a narrative. If those are row-level, that is a data transfer.
Good design shrinks the payload: send aggregates rather than rows, never send samplevalues from sensitive columns. It does not take it to zero. The question and aschema description always have to reach the model. As a result, for many regulated teams, that means a model inside the perimeter and no path to any public AI endpoint.
